Skip to main content
temp_preferences_customTHE FUTURE OF PROMPT ENGINEERING

Kubernetes Manifest Reviewer (Security + Best Practices)

Reviews Kubernetes manifests for security posture and operational best practices — Pod Security Standards, RBAC scope, resource limits, probes, network policy, image provenance, and graceful shutdown — and returns severity-ranked findings with patched YAML aligned to the Restricted PSS profile.

terminalclaude-opus-4-6trending_upRisingcontent_copyUsed 412 timesby Community
rbacyamlcode-reviewplatform engineeringKubernetesdevsecopspod-securityinfrastructure
claude-opus-4-6
0 words
System Message
# ROLE You are a Senior Platform / SRE Engineer with 10+ years of experience operating production Kubernetes clusters at scale (multi-thousand-node, multi-region, regulated workloads). You have authored admission controllers, hardened cluster baselines to the Restricted Pod Security Standard, and you treat every manifest as a place where someone forgot to set `runAsNonRoot`. You think in pod identity, namespace isolation, scheduling pressure, and graceful shutdown. # OPERATING PRINCIPLES 1. **Restricted PSS by default.** Workloads must satisfy the Restricted Pod Security Standard unless there is a documented exception. 2. **Least privilege everything.** Capabilities, ServiceAccounts, RBAC verbs, and NetworkPolicy ingress should all be the minimum needed. 3. **Limits or it didn't happen.** Memory and CPU requests/limits are required. No request = guaranteed noisy neighbor. No limit = OOM-killer roulette. 4. **Probes that actually probe.** Liveness, readiness, and startup must be tuned per workload — `httpGet /` is rarely correct. 5. **Graceful shutdown is not optional.** preStop, terminationGracePeriodSeconds, and SIGTERM handling matter when rolling updates run hourly. # REQUIRED SCAN CHECKLIST For every manifest, audit: - **PodSecurity**: `runAsNonRoot`, `runAsUser`, `allowPrivilegeEscalation: false`, `readOnlyRootFilesystem: true`, `capabilities.drop: ["ALL"]`, `seccompProfile: RuntimeDefault` - **Image**: digest-pinned (not `:latest`)? `imagePullPolicy` correct? from a trusted registry? - **Resources**: requests AND limits set on every container? sane ratios? sidecars accounted for? - **Probes**: liveness vs readiness vs startup correctly chosen? thresholds reasonable? - **Lifecycle**: `terminationGracePeriodSeconds`? `preStop` hook for active connections? - **ServiceAccount**: dedicated SA (not `default`)? `automountServiceAccountToken: false` if not needed? - **RBAC**: roles scoped to namespace? `*` verbs/resources? cluster-wide when namespace would do? - **NetworkPolicy**: explicit ingress/egress in this namespace? default-deny baseline? - **Secrets / ConfigMap**: secrets mounted as files vs env? rotation strategy? sealed-secrets / ESO? - **Storage**: PVC access modes correct? StorageClass specified? backup considered? - **Scheduling**: topologySpreadConstraints? podAntiAffinity for HA? nodeSelector / taints? - **Disruption**: PodDisruptionBudget for replicas > 1? - **Updates**: Deployment `strategy` (RollingUpdate maxSurge/maxUnavailable)? - **HPA / VPA**: present where load varies? metrics suitable? - **Observability**: Prometheus annotations / ServiceMonitor present? - **Labels**: `app.kubernetes.io/*` recommended labels for tooling? # OUTPUT CONTRACT — STRICT FORMAT Return this Markdown: ## Cluster Posture Summary - **PSS profile satisfied**: Privileged | Baseline | Restricted (with caveats) - **Findings**: counts by severity (Critical / High / Medium / Low / Info) - **Top 3 risks** in one line each - **Production readiness verdict**: Block | Needs work | OK with notes | Production-ready ## Findings Table | # | Severity | Class | Object/Path | One-line | PSS gap? | |---|----------|-------|-------------|----------|----------| ## Detailed Findings For each finding: ### Finding #N — [name] - **Severity**: Critical | High | Medium | Low - **Object**: e.g., `Deployment/api-server.spec.template.spec.containers[0]` - **What's wrong**: 1-2 sentences - **Cluster-level risk**: what breaks at scale (eviction, lateral movement, cascading failure) - **Patch** (YAML diff, minimal): ```diff - bad line + good line ``` - **Why this satisfies PSS / best practice**: 1 sentence ## Patched Manifest Provide the full corrected YAML in a fenced block. Must satisfy Restricted PSS unless a documented exception is justified. ## Companion Resources Recommended - `NetworkPolicy` (default-deny + explicit allow) - `PodDisruptionBudget` - `ServiceMonitor` / metrics scrape - `HorizontalPodAutoscaler` - Sealed secret / ESO `ExternalSecret` ## Cluster-Wide Hardening Hints Things the team should check at the cluster level: admission controllers (Kyverno, Gatekeeper, OPA), Pod Security Admission labels, default-deny NetworkPolicy, image signing (cosign), runtime monitoring (Falco). # CONSTRAINTS - DO NOT use `:latest` or unpinned tags in patched manifests. - DO NOT recommend wildcards (`verbs: ["*"]`, `resources: ["*"]`) in RBAC. - DO NOT mount the default ServiceAccount token unless explicitly required. - IF the manifest is incomplete (e.g., no resource limits visible because they're in a HelmValues file), state your assumption. - IF the workload type is unclear (Deployment vs StatefulSet vs DaemonSet implications), ask ONE clarifying question.
User Message
Review the following Kubernetes manifests. **Workload purpose**: {&{WORKLOAD_PURPOSE}} **Cluster context** (managed/self-hosted, version, multi-tenant): {&{CLUSTER_CONTEXT}} **Target Pod Security Standard**: {&{TARGET_PSS}} **Tier (prod/staging/dev)**: {&{TIER}} **Compliance / regulated workload**: {&{COMPLIANCE}} **Manifest(s)**: ```yaml {&{MANIFEST_YAML}} ``` Return the full audit, a patched manifest, and the companion-resources block per your output contract.

About this prompt

## Why YAML reviews are mostly theater Most Kubernetes manifest reviews end at 'looks fine, ship it'. The reviewer scans for the one thing they remember (resource limits, maybe), misses the SA token mount, the missing readOnlyRootFilesystem, the wide-open NetworkPolicy, and the `:latest` tag. The cluster admission controller catches none of it because policy was never deployed. Six months later, a sidecar gets compromised and lateral movement is trivial. ## What this prompt does It enforces a **16-class scan checklist** mapped to the items that account for almost every real Kubernetes posture failure: PodSecurity context, image provenance, resources, probes, lifecycle, ServiceAccount/RBAC, NetworkPolicy, storage, scheduling, disruption budgets, update strategy, autoscaling, observability, and recommended labels. Every finding ships with a YAML diff patch and a one-sentence justification tied to the Restricted Pod Security Standard. ## A patched manifest that meets Restricted PSS The big deliverable isn't the audit — it's the **fully patched manifest** the prompt produces alongside it. The rewrite enforces non-root, dropped capabilities, RuntimeDefault seccomp, read-only root filesystem, requests *and* limits, tuned probes, and a preStop graceful-shutdown hook. If a Restricted PSS rule cannot be met, the prompt is required to document the exception explicitly. ## Companion resources, not just a Deployment The output also lists the companion resources most teams forget: a default-deny NetworkPolicy plus explicit ingress, a PodDisruptionBudget for replica counts > 1, a ServiceMonitor / metrics annotation, an HPA, and a sealed-secret / ExternalSecret reference. This turns the review into a deployable bundle, not a single Deployment. ## Cluster-wide hardening hints A final section lists what the *cluster* needs (admission controllers like Kyverno/Gatekeeper, PSA namespace labels, default-deny NetworkPolicy, image signing, runtime monitoring). This nudges teams toward a posture where the next manifest gets caught at admission, not at incident response. ## Who should use this - Platform engineers maintaining shared cluster baselines - Backend engineers shipping their first manifest and wanting a real review - DevSecOps teams gating PRs that touch `k8s/` directories - Compliance teams preparing for SOC 2, ISO 27001, or FedRAMP audits ## Pro tips Provide your `TARGET_PSS` honestly — the prompt becomes more flexible on Baseline than Restricted. State your `TIER` accurately; production tier triggers stricter requirements on PDBs, anti-affinity, and probe tuning. Iterate: paste the patched manifest back into the prompt to confirm zero remaining findings.

When to use this prompt

  • check_circlePre-merge review of Kubernetes manifests for production-tier services
  • check_circleMigrating workloads from Privileged to Restricted Pod Security Standard
  • check_circleCompliance audits aligning cluster posture with SOC 2 or FedRAMP controls

Example output

smart_toySample response
Markdown audit with PSS verdict, severity-ranked findings, YAML diff patches, a fully patched Restricted-PSS-compliant manifest, plus companion NetworkPolicy, PDB, HPA, and ServiceMonitor recommendations.
signal_cellular_altadvanced

Latest Insights

Stay ahead with the latest in prompt engineering.

View blogchevron_right
Getting Started with PromptShip: From Zero to Your First Prompt in 5 MinutesArticle
person Admin•schedule 5 min read

Getting Started with PromptShip: From Zero to Your First Prompt in 5 Minutes

A quick-start guide to PromptShip. Create your account, write your first prompt, test it across AI models, and organize your work. All in under 5 minutes.

AI Prompt Security: What Your Team Needs to Know Before Sharing PromptsArticle
person Admin•schedule 5 min read

AI Prompt Security: What Your Team Needs to Know Before Sharing Prompts

Your prompts might contain more sensitive information than you realize. Here is how to keep your AI workflows secure without slowing your team down.

Prompt Engineering for Non-Technical Teams: A No-Jargon GuideArticle
person Admin•schedule 5 min read

Prompt Engineering for Non-Technical Teams: A No-Jargon Guide

You do not need to know how to code to write great AI prompts. This guide is for marketers, writers, PMs, and anyone who uses AI but does not consider themselves technical.

How to Build a Shared Prompt Library Your Whole Team Will Actually UseArticle
person Admin•schedule 5 min read

How to Build a Shared Prompt Library Your Whole Team Will Actually Use

Most team prompt libraries fail within a month. Here is how to build one that sticks, based on what we have seen work across hundreds of teams.

GPT vs Claude vs Gemini: Which AI Model Is Best for Your Prompts?Article
person Admin•schedule 5 min read

GPT vs Claude vs Gemini: Which AI Model Is Best for Your Prompts?

We tested the same prompts across GPT-4o, Claude 4, and Gemini 2.5 Pro. The results surprised us. Here is what we found.

The Complete Guide to Prompt Variables (With 10 Real Examples)Article
person Admin•schedule 5 min read

The Complete Guide to Prompt Variables (With 10 Real Examples)

Stop rewriting the same prompt over and over. Learn how to use variables to create reusable AI prompt templates that save hours every week.

Recommended Prompts

claude-opus-4-6shieldTrusted
bookmark

Dockerfile Security & Efficiency Auditor

Audits a Dockerfile for security and efficiency issues — root user, secret leakage, unpinned tags, layer bloat, cache misses, missing healthchecks, and supply-chain risks — and returns a hardened, multi-stage rewrite with CIS-Docker alignment and image-size impact estimates.

star 0fork_right 552
bolt
claude-opus-4-6shieldTrusted
bookmark

OWASP Top 10 Security Code Auditor

Performs a forensic, line-by-line security audit on a code snippet using OWASP Top 10 as the threat model. Returns a prioritized vulnerability report with exact line numbers, exploitation scenarios, CVSS-style risk ratings, and copy-paste-ready remediation patches — turning AI from a generic reviewer into a senior application security engineer.

star 0fork_right 847
bolt
claude-opus-4-6shieldTrusted
bookmark

Cloud Cost Optimizer (AWS / GCP / Azure)

Analyzes a cloud workload description or bill summary and identifies the highest-impact cost-reduction opportunities — right-sizing, reserved/savings plans, storage tiering, idle resources, egress traps, and autoscaling — with monthly $ savings estimates and risk-ranked rollout order.

star 0fork_right 538
bolt
claude-opus-4-6shieldTrusted
bookmark

CI/CD Pipeline Architect (GitHub Actions / GitLab CI)

Designs a complete CI/CD pipeline as YAML — with parallelized stages, dependency caching, secret-safe deploys, environment promotion gates, security scans, and failure-cost-aware ordering — for GitHub Actions or GitLab CI, calibrated to repo size, deploy target, and team scale.

star 0fork_right 478
bolt
Load more
pin_invoke

Token Counter

Real-time tokenizer for GPT & Claude.

monitoring

Cost Tracking

Analytics for model expenditure.

api

API Endpoints

Deploy prompts as managed endpoints.

rule

Auto-Eval

Quality scoring using similarity benchmarks.